Pages

▼
Wednesday, December 22, 2021

On Writing DFIR Books, pt III

›
Editing and Feedback When it comes to writing books, having someone can trust to give you honest, thoughtful, insightful feedback is a huge ...
Saturday, December 18, 2021

Reasons to go looking in the Registry

›
Chris Sanders tweeted out an interesting pair of questions recently, and the simple fact is that for me to fully answer the question, the t...
Tuesday, December 14, 2021

Tips for DFIR Analysts, pt VI

›
Context & Finding Persistence I was looking into an unusual mechanism for launching applications recently, and that research brought bac...
Thursday, November 25, 2021

Threat Hunting, IRL

›
While I worked for one company, I did a lot of public speaking on the value of threat hunting. During these events, I met a lot of folks who...
Tuesday, November 23, 2021

Tips for DFIR Analysts, pt. V

›
Over the years, I've seen DFIR referred to in terms of special operations forces. I've seen incident response teams referred to as ...
2 comments:
Monday, November 01, 2021

Tips for DFIR Analysts, pt IV

›
Context is king, it makes all the difference. You may see something run in EDR telemetry, or in logs, but the context of when it ran in rel...
3 comments:
Sunday, October 10, 2021

Data Exfiltration, Revisited

›
I've posted on the topic of data exfiltration before ( here , etc.) but often it's a good idea to revisit the topic. After all, it w...
Friday, October 08, 2021

Tips for DFIR Analysts, pt III

›
Learn to think critically. Don't take what someone says as gospel, just because they say it. Support findings with data, and clearly com...

EDR Bypasses

›
During my time in the industry, I've been blessed to have opportunities to engage with a number of different EDR tools/frameworks at dif...
Thursday, September 23, 2021

Imposter Syndrome

›
Imposter Syndrome .  This is something many of us have experienced to one degree or another, at various times. Many have experienced, some h...
2 comments:
Sunday, September 19, 2021

Distros and RegRipper

›
Over the years, every now and then I've taken a look around to try to see where RegRipper is used. I noticed early on that it's incl...

On Writing DFIR Books, pt II

›
Part I of this series  kicked things off for us, and honestly I have no idea how long this series will be...I'm just writing the posts w...
Monday, September 06, 2021

Tips for DFIR Analysts, pt II

›
On the heels of my first post with this subject, I thought I'd continue adding tips as they came to mind... I've been engaged with ...

On Writing DFIR Books, pt I

›
During my time in the industry, I've authored 9 books under three imprints, and co-authored a tenth. There, I said it. The first step in...
Friday, August 27, 2021

Building a Career in CyberSecurity

›
There's been a lot of discussion on social media around how to "break into" the cybersecurity field, not only for folks just s...
Thursday, August 26, 2021

Tips for DFIR Analysts

›
Over the years as a DFIR analyst...first doing digital forensics analysis, and then incorporating that analysis as a component of IR activit...
2 comments:
Friday, June 25, 2021

What We Know About The Ransomware Economy

›
Okay, I think that we can all admit that ransomware has consumed the news cycle of late, thanks to high visibility attacks such as Colonial ...

Thoughts on Assessing Threat Actor Intent & Sophistication

›
I was reading this Splunk blog post recently, and I have to say up front, I was disappointed by the fact that the promise of the title (i.e...